Keycloak

import useBaseUrl from '@docusaurus/useBaseUrl'; import DefaultBehaviour from './_default-behaviour.md'; import OverrideIntro from './_override-intro.md'; import OverrideExampleIntro from './_override-example-intro.md'; import UsingAuthNote from './_using-auth-note.md'; import WaspFileStructureNote from './_wasp-file-structure-note.md'; import GetUserFieldsType from './_getuserfields-type.md'; import { CardLink } from '@site/src/components/CardLink'; import KeycloakData from '../entities/_keycloak-data.md'; import AccessingUserDataNote from '../_accessing-user-data-note.md'; import SocialLoginClientPages from './_social-login-client-pages.md';

Wasp supports Keycloak Authentication out of the box.

Keycloak is an open-source identity and access management solution for modern applications and services. Keycloak provides both SAML and OpenID protocol solutions. It also has a very flexible and powerful administration UI.

Let's walk through enabling Keycloak authentication, explain some of the default settings, and show how to override them.

Setting up Keycloak Auth

Enabling Keycloak Authentication comes down to a series of steps:

1. Enabling Keycloak authentication in the Wasp file.
2. Adding the User entity.
3. Creating a Keycloak client.
4. Adding the necessary Routes and Pages
5. Using Auth UI components in our Pages.

1. Adding Keycloak Auth to Your Wasp File

Let's start by properly configuring the Auth object:

import { app } from "@wasp.sh/spec"

export default app({
  name: "myApp",
  wasp: { version: "{latestWaspVersion}" },
  title: "My App",
  auth: {
    // 1. Specify the User entity (we'll define it next)
    // highlight-next-line
    userEntity: "User",
    methods: {
      // 2. Enable Keycloak Auth
      // highlight-next-line
      keycloak: {}
    },
    onAuthFailedRedirectTo: "/login"
  },
  // ...
})

userEntity is explained in the social auth overview.

2. Adding the User Entity

Let's now define the auth.userEntity entity in the schema.prisma file:

// 3. Define the user entity
model User {
  // highlight-next-line
  id Int @id @default(autoincrement())
  // Add your own fields below
  // ...
}

3. Creating a Keycloak Client

1. Log into your Keycloak admin console.
2. Under Clients, click on Create Client.

1. Fill in the Client ID and choose a name for the client.

1. In the next step, enable Client Authentication.

1. Under Valid Redirect URIs, add http://localhost:3001/auth/keycloak/callback for local development.

• Once you know on which URL(s) your API server will be deployed, also add those URL(s).
• For example: https://my-server-url.com/auth/keycloak/callback.

1. Click Save.
2. In the Credentials tab, copy the Client Secret value, which we'll use in the next step.

4. Adding Environment Variables

Add these environment variables to the .env.server file at the root of your project (take their values from the previous step):

KEYCLOAK_CLIENT_ID=your-keycloak-client-id
KEYCLOAK_CLIENT_SECRET=your-keycloak-client-secret
KEYCLOAK_REALM_URL=https://your-keycloak-url.com/realms/master

We assumed in the KEYCLOAK_REALM_URL env variable that you are using the master realm. If you are using a different realm, replace master with your realm name.

5. Adding the Necessary Routes and Pages

Let's define the necessary authentication Routes and Pages.

Add the following code to your main.wasp.ts file:

import { app, page, route } from "@wasp.sh/spec"
import { LoginPage } from "./src/pages/auth" with { type: "ref" }

export default app({
  // ...
  spec: [
    route("LoginRoute", "/login", page(LoginPage)),
  ],
})

We'll define the React components for these pages in the src/pages/auth.{jsx,tsx} file below.

6. Create the Client Pages

Conclusion

Yay, we've successfully set up Keycloak Auth!

Running wasp db migrate-dev and wasp start should now give you a working app with authentication. To see how to protect specific pages (i.e., hide them from non-authenticated users), read the docs on using auth.

Default Behaviour

Add keycloak: {} to the auth.methods object to use it with default settings:

import { app } from "@wasp.sh/spec"

export default app({
  name: "myApp",
  wasp: { version: "{latestWaspVersion}" },
  title: "My App",
  auth: {
    userEntity: "User",
    methods: {
      // highlight-next-line
      keycloak: {}
    },
    onAuthFailedRedirectTo: "/login"
  },
  // ...
})

Overrides

Data Received From Keycloak

We are using Keycloak's API and its /userinfo endpoint to fetch the user's data.

{
  sub: "5adba8fc-3ea6-445a-a379-13f0bb0b6969",
  email_verified: true,
  name: "Test User",
  preferred_username: "test",
  given_name: "Test",
  family_name: "User",
  email: "[email protected]"
}

The fields you receive will depend on the scopes you requested. The default scope is set to profile only. If you want to get the user's email, you need to specify the email scope in the configFn function.

Using the Data Received From Keycloak

import { app } from "@wasp.sh/spec"
import { getConfig, userSignupFields } from "./src/auth/keycloak" with { type: "ref" }

export default app({
  name: "myApp",
  wasp: { version: "{latestWaspVersion}" },
  title: "My App",
  auth: {
    userEntity: "User",
    methods: {
      keycloak: {
        // highlight-next-line
        configFn: getConfig,
        // highlight-next-line
        userSignupFields
      }
    },
    onAuthFailedRedirectTo: "/login"
  },
  // ...
})

model User {
  id          Int    @id @default(autoincrement())
  username    String @unique
  displayName String
}

// ...

import { defineUserSignupFields } from "wasp/server/auth"

export const userSignupFields = defineUserSignupFields({
  username: () => "hardcoded-username",
  displayName: (data: any) => data.profile.name,
})

export function getConfig() {
  return {
    scopes: ["profile", "email"],
  }
}

Using Auth

When you receive the user object on the client or the server, you'll be able to access the user's Keycloak ID like this:

API Reference

<CardLink to="../../api/@wasp.sh/spec/interfaces/SocialAuthConfig" kind="api" title="SocialAuthConfig" description="All the options for the keycloak auth method." />

For the provider-specific behavior of the configFn and userSignupFields functions, check the Overrides section. For behavior common to all providers, check the Social Auth Overview.